Anvilogic low experimental other

Adfind Commands [snowflake-crowdstrikefdr_process]

AdFind is a free command-line query tool that can be used for gathering information from Active Directory. In some instances Adversaries have renamed adfind in order to avoid detection. This use case looks for common commands of Adfind. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, BlackMatter, Conti, DarkSide, FIN6, FIN7, FIN12, Karakurt, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE PRESIDENT/TA416/RedDelta), Traveling Spider, Wizard Spider, Yanluowang -- Software Association: BazarLoader, Blackcat/ALPHV, Conti, DatopLoader, Dridex, Entropy, Lockbit, Nefilim, Quantum, Sodinokibi/REvil, Trickbot, XingLocker

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process_path, '.*(objectcategory
| trustdmp
| member\s(.*)?-list).*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...